Malicious software was installed inside customer server environments at GMO Internet’s Onamae.com Desktop Cloud, and trading credentials stored in those environments may have been obtained and used without authorization. GMO confirmed the breach on October 20, with the incident affecting a virtual private server platform retail forex traders use to run automated trading software around the clock.
Virtual private servers keep automated trading tools running continuously, which also means login credentials sit on a remotely managed machine outside the trader’s direct control.
When the Infrastructure Is the Vulnerability
A cloud-level compromise exposed just how much financial risk traders concentrate in third-party server environments.
According to GMO’s disclosure, the company identified 26,739 servers as potentially affected. That figure represents servers flagged for potential impact, not confirmed cases of unauthorized access. GMO suspended new applications and control-panel access on October 20, then began sequentially shutting down servers across all service plans starting at 4 a.m. on October 21 to prevent further damage.
The attackers issued a demand for money, reportedly $50 million in cryptocurrency, though that specific figure has not been confirmed in GMO’s primary disclosure. GMO declined to pay, reasoning that payment would not guarantee the deletion of stolen data or stop further attacks. GMO reported the incident to police and engaged a specialist security firm to investigate the intrusion route and the scope of the impact.
What Affected Customers Should Do Now
GMO has issued specific guidance and compensation commitments for users of the compromised service.
Attackers reportedly threatened further unauthorized trading credentials stored in those environments may have been obtained and used without authorization activity involving more than 70 securities and foreign-exchange firms, along with potential data disclosure and ransomware activity. That figure reflects attacker threats and reports of irregular activity; it does not establish confirmed breaches at every named firm. Reports also indicated that GMO shares fell nearly 16% to a four-month low following the disclosure, though that figure requires independent confirmation from exchange data or reputable financial reporting before it can be treated as settled.
GMO’s official guidance to affected customers is straightforward. Change trading-account and trading-tool credentials immediately, using a device that was not used for trading on the compromised service. Disconnect any active sessions, review transaction histories and account balances, and enable two-factor authentication.
On compensation, GMO pledged a ÂĄ5,000 goodwill payment to all current Onamae.com Desktop Cloud users, regardless of whether they incurred losses. The company also committed to compensating verified trading losses and associated fees, with final amounts subject to its ongoing verification process.
The compromised infrastructure remained offline while GMO’s investigation continued. The convenience of cloud-hosted trading carries a risk that this incident makes concrete: the server holding your credentials and active sessions belongs to someone else, and their security posture directly affects yours.
